Ok.. I thought I had all of my ports working as I expect but found this evening that my telnet connections are being ignored making me have to jump on the console to temporarily disable PF.. Any ideas on what I missed?
Code:
# external interfaces
ext_if = "bge0"
# internal jailed servers for services
jail_smtp_server = "10.0.1.4"
jail_mys_webserver = "10.0.1.7"
local_users = "10.0.0.0/26"
NoRouteIPs = "{ 192.168.0.0/16, 172.16.0.0/12 }"
# 590x = VNC, 783 = spamd/spamc chatter
localsvcs = "{ domain telnet 5900 5901 5902 5903 783 }"
webports = "{ http https }"
smtpports = "{ smtp imaps sieve }"
sambaports = "{ netbios-ns netbios-dgm netbios-ssn microsoft-ds loc-srv }"
icmp_types = "echoreq"
domain_ports = "domain"
# the tcp_services below should encompass all services above except icmp..
tcp_services = "{ domain telnet 5900 5901 5902 5903 783 http https smtp imaps sieve netbios-ns netbios-dgm netbios-ssn microsoft-ds loc-srv }"
udp_services = "{ domain netbios-ns netbios-dgm netbios-ssn microsoft-ds loc-srv }"
set loginterface $ext_if
set skip on lo0
scrub in all
rdr on $ext_if proto tcp from any to any port $webports -> $jail_mys_webserver
rdr on $ext_if proto tcp from 127.0.0.1 to $ext_if port 783 -> $jail_smtp_server
rdr on $ext_if proto tcp from any to $ext_if port $smtpports -> $jail_smtp_server
block all
pass out proto tcp to any port $tcp_services
pass proto udp to any port $udp_services
block in quick on $ext_if from $NoRouteIPs to any
block out quick on $ext_if from any to $NoRouteIPs
# icmp Requests
pass in inet proto icmp all icmp-type $icmp_types keep state
# pass all traffic to and from the local network
pass in quick log on $ext_if proto tcp from $local_users to $ext_if port $localsvcs keep state
pass in quick log on $ext_if proto tcp from any to $jail_mys_webserver port $webports keep state
pass in quick log on $ext_if proto tcp from any to $jail_smtp_server port $smtpports keep state
Is something actually listening on port 23? ([cmd=]sockstat -l4p23[/cmd])